2018

A vulnerability in the notifications Push API where notifications can be sent through service workers by web content wit

A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. Thi

A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing th

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject script

WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache",

When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially expl

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentiall

Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corrup

If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed

The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but thi

Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension ma

WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an

A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potent

A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while

A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collec

A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially e

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used fo

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprin

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attac

Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resou

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing an

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer be

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the do

A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content,

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for la

The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with ano

When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This re

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page sour

Response header name interning does not have same-origin protections and these headers are stored in a global registry.

On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though

On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, s

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes

If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example

An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation th

The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Intern

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar.

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. T

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs,

The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer w

An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations. This vulnerability

A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages du

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files tha

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base doma

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecry

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to crea